ScreenShot
| Created | 2023.10.13 08:40 | Machine | s1_win7_x6403 |
| Filename | stub.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 10 detected (malicious, moderate confidence, Artemis, Greedy, Znyonm, Detected, CLOUD, Outbreak) | ||
| md5 | 7267c31ceaa3b35c96494360402a4788 | ||
| sha256 | a7cf48b6108e96096026425b964905f2035427c2af97fca0618d5947515f25b2 | ||
| ssdeep | 98304:Yh0Af9saCDQeXNGUY1WpI1Hgj0hA7cQcPnkWDq0vH6ddW6TktuFfp39sqfMXGqh0:iV0DQKcLQcPnkWDq0vH6ddW6TktuFfpD | ||
| imphash | ece4846704febbd2176fd563dfd00581 | ||
| impfuzzy | 96:jsHyzx3rXVqiWD5JSbI5Ckzav5fcg+PJtM6IWQws7:IHyNrEiWtgbI5CkzafWQn | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | Appends a known CryptoMix ransomware file extension to files that have been encrypted |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Communicates with host for which no DNS query was performed |
| watch | File has been identified by 10 AntiVirus engines on VirusTotal as malicious |
| watch | Harvests credentials from local email clients |
| watch | Harvests credentials from local FTP client softwares |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Collects information to fingerprint the system (MachineGuid |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (85cnts) ?
Suricata ids
ET HUNTING Telegram API Domain in DNS Lookup
ET INFO TLS Handshake Failure
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
ntdll.dll
0x1404085c0 RtlCaptureContext
0x1404085c8 RtlLookupFunctionEntry
0x1404085d0 RtlUnwindEx
0x1404085d8 NtCancelIoFileEx
0x1404085e0 RtlVirtualUnwind
0x1404085e8 NtReadFile
0x1404085f0 NtWriteFile
0x1404085f8 NtCreateFile
0x140408600 RtlNtStatusToDosError
0x140408608 NtDeviceIoControlFile
0x140408610 RtlPcToFileHeader
kernel32.dll
0x1404080b8 CreateEventW
0x1404080c0 WaitForMultipleObjects
0x1404080c8 GetOverlappedResult
0x1404080d0 WaitForSingleObject
0x1404080d8 GetExitCodeProcess
0x1404080e0 GetSystemInfo
0x1404080e8 GetComputerNameExW
0x1404080f0 QueryPerformanceCounter
0x1404080f8 QueryPerformanceFrequency
0x140408100 AddVectoredExceptionHandler
0x140408108 SetThreadStackGuarantee
0x140408110 HeapReAlloc
0x140408118 SwitchToThread
0x140408120 GetConsoleOutputCP
0x140408128 GetStringTypeW
0x140408130 GetQueuedCompletionStatusEx
0x140408138 CreateIoCompletionPort
0x140408140 SetFileCompletionNotificationModes
0x140408148 FindClose
0x140408150 GetLastError
0x140408158 DeleteFileW
0x140408160 FindNextFileW
0x140408168 CloseHandle
0x140408170 ReleaseSRWLockExclusive
0x140408178 AcquireSRWLockExclusive
0x140408180 GetFileType
0x140408188 PostQueuedCompletionStatus
0x140408190 SetStdHandle
0x140408198 SetEnvironmentVariableW
0x1404081a0 GetCPInfo
0x1404081a8 GetOEMCP
0x1404081b0 GetACP
0x1404081b8 IsValidCodePage
0x1404081c0 HeapAlloc
0x1404081c8 FindFirstFileExW
0x1404081d0 GetProcessHeap
0x1404081d8 HeapFree
0x1404081e0 InitializeCriticalSectionAndSpinCount
0x1404081e8 TlsAlloc
0x1404081f0 LCMapStringW
0x1404081f8 CompareStringW
0x140408200 FlsFree
0x140408208 FlsSetValue
0x140408210 SleepConditionVariableSRW
0x140408218 WakeConditionVariable
0x140408220 WakeAllConditionVariable
0x140408228 TlsGetValue
0x140408230 FormatMessageW
0x140408238 MoveFileExW
0x140408240 LockFileEx
0x140408248 UnlockFile
0x140408250 Sleep
0x140408258 FlsGetValue
0x140408260 GetModuleHandleA
0x140408268 GetProcAddress
0x140408270 GetCurrentThread
0x140408278 TryAcquireSRWLockExclusive
0x140408280 GetStdHandle
0x140408288 GetConsoleMode
0x140408290 MultiByteToWideChar
0x140408298 TlsSetValue
0x1404082a0 SetLastError
0x1404082a8 GetEnvironmentVariableW
0x1404082b0 GetTempPathW
0x1404082b8 CreateFileW
0x1404082c0 GetFileInformationByHandle
0x1404082c8 GetFileInformationByHandleEx
0x1404082d0 GetFullPathNameW
0x1404082d8 GetFinalPathNameByHandleW
0x1404082e0 SetFilePointerEx
0x1404082e8 GetModuleHandleW
0x1404082f0 CreateDirectoryW
0x1404082f8 FindFirstFileW
0x140408300 FlsAlloc
0x140408308 GetTimeZoneInformation
0x140408310 GetCommandLineW
0x140408318 GetCommandLineA
0x140408320 GetEnvironmentStringsW
0x140408328 FreeEnvironmentStringsW
0x140408330 CompareStringOrdinal
0x140408338 GetModuleFileNameW
0x140408340 GetSystemDirectoryW
0x140408348 GetWindowsDirectoryW
0x140408350 CreateProcessW
0x140408358 GetFileAttributesW
0x140408360 GetCurrentProcess
0x140408368 DuplicateHandle
0x140408370 GetCurrentProcessId
0x140408378 CreateThread
0x140408380 SleepEx
0x140408388 WriteFileEx
0x140408390 ReadFileEx
0x140408398 CancelIo
0x1404083a0 ReadFile
0x1404083a8 GetSystemTimeAsFileTime
0x1404083b0 SetFileInformationByHandle
0x1404083b8 CopyFileExW
0x1404083c0 SetHandleInformation
0x1404083c8 ExitProcess
0x1404083d0 GetModuleHandleExW
0x1404083d8 FreeLibraryAndExitThread
0x1404083e0 TlsFree
0x1404083e8 LoadLibraryExW
0x1404083f0 FreeLibrary
0x1404083f8 GetNativeSystemInfo
0x140408400 FlushFileBuffers
0x140408408 GetTickCount
0x140408410 MapViewOfFile
0x140408418 CreateFileMappingW
0x140408420 FormatMessageA
0x140408428 GetSystemTime
0x140408430 WideCharToMultiByte
0x140408438 SystemTimeToFileTime
0x140408440 GetFileSize
0x140408448 LocalFree
0x140408450 HeapDestroy
0x140408458 HeapCompact
0x140408460 LoadLibraryW
0x140408468 DeleteFileA
0x140408470 WaitForSingleObjectEx
0x140408478 LoadLibraryA
0x140408480 CreateFileA
0x140408488 FlushViewOfFile
0x140408490 OutputDebugStringW
0x140408498 GetFileAttributesExW
0x1404084a0 GetFileAttributesA
0x1404084a8 GetDiskFreeSpaceA
0x1404084b0 GetTempPathA
0x1404084b8 HeapSize
0x1404084c0 HeapValidate
0x1404084c8 UnmapViewOfFile
0x1404084d0 CreateMutexW
0x1404084d8 UnlockFileEx
0x1404084e0 SetEndOfFile
0x1404084e8 GetFullPathNameA
0x1404084f0 SetFilePointer
0x1404084f8 LockFile
0x140408500 OutputDebugStringA
0x140408508 GetDiskFreeSpaceW
0x140408510 WriteFile
0x140408518 HeapCreate
0x140408520 AreFileApisANSI
0x140408528 InitializeCriticalSection
0x140408530 EnterCriticalSection
0x140408538 LeaveCriticalSection
0x140408540 TryEnterCriticalSection
0x140408548 DeleteCriticalSection
0x140408550 GetCurrentThreadId
0x140408558 EncodePointer
0x140408560 WriteConsoleW
0x140408568 CreateNamedPipeW
0x140408570 ExitThread
0x140408578 GetStartupInfoW
0x140408580 IsDebuggerPresent
0x140408588 InitializeSListHead
0x140408590 IsProcessorFeaturePresent
0x140408598 UnhandledExceptionFilter
0x1404085a0 SetUnhandledExceptionFilter
0x1404085a8 TerminateProcess
0x1404085b0 RaiseException
crypt.dll
0x140408040 BCryptGenRandom
crypt32.dll
0x140408050 CertGetCertificateChain
0x140408058 CertFreeCertificateContext
0x140408060 CertDuplicateCertificateChain
0x140408068 CertEnumCertificatesInStore
0x140408070 CertDuplicateStore
0x140408078 CertDuplicateCertificateContext
0x140408080 CertFreeCertificateChain
0x140408088 CertVerifyCertificateChainPolicy
0x140408090 CertOpenStore
0x140408098 CryptUnprotectData
0x1404080a0 CertAddCertificateContextToStore
0x1404080a8 CertCloseStore
secur32.dll
0x140408620 GetUserNameExW
0x140408628 FreeContextBuffer
0x140408630 DeleteSecurityContext
0x140408638 FreeCredentialsHandle
0x140408640 EncryptMessage
0x140408648 ApplyControlToken
0x140408650 AcceptSecurityContext
0x140408658 AcquireCredentialsHandleA
0x140408660 InitializeSecurityContextW
0x140408668 QueryContextAttributesW
0x140408670 DecryptMessage
advapi32.dll
0x140408000 CredFree
0x140408008 GetUserNameW
0x140408010 SystemFunction036
0x140408018 RegOpenKeyExW
0x140408020 RegCloseKey
0x140408028 RegQueryValueExW
0x140408030 CredEnumerateA
ws2_32.dll
0x140408680 WSAIoctl
0x140408688 ioctlsocket
0x140408690 WSASocketW
0x140408698 connect
0x1404086a0 getsockopt
0x1404086a8 shutdown
0x1404086b0 getaddrinfo
0x1404086b8 freeaddrinfo
0x1404086c0 WSAStartup
0x1404086c8 setsockopt
0x1404086d0 WSACleanup
0x1404086d8 recv
0x1404086e0 closesocket
0x1404086e8 send
0x1404086f0 getsockname
0x1404086f8 WSAGetLastError
0x140408700 getpeername
0x140408708 WSASend
0x140408710 ind
EAT(Export Address Table) is none
ntdll.dll
0x1404085c0 RtlCaptureContext
0x1404085c8 RtlLookupFunctionEntry
0x1404085d0 RtlUnwindEx
0x1404085d8 NtCancelIoFileEx
0x1404085e0 RtlVirtualUnwind
0x1404085e8 NtReadFile
0x1404085f0 NtWriteFile
0x1404085f8 NtCreateFile
0x140408600 RtlNtStatusToDosError
0x140408608 NtDeviceIoControlFile
0x140408610 RtlPcToFileHeader
kernel32.dll
0x1404080b8 CreateEventW
0x1404080c0 WaitForMultipleObjects
0x1404080c8 GetOverlappedResult
0x1404080d0 WaitForSingleObject
0x1404080d8 GetExitCodeProcess
0x1404080e0 GetSystemInfo
0x1404080e8 GetComputerNameExW
0x1404080f0 QueryPerformanceCounter
0x1404080f8 QueryPerformanceFrequency
0x140408100 AddVectoredExceptionHandler
0x140408108 SetThreadStackGuarantee
0x140408110 HeapReAlloc
0x140408118 SwitchToThread
0x140408120 GetConsoleOutputCP
0x140408128 GetStringTypeW
0x140408130 GetQueuedCompletionStatusEx
0x140408138 CreateIoCompletionPort
0x140408140 SetFileCompletionNotificationModes
0x140408148 FindClose
0x140408150 GetLastError
0x140408158 DeleteFileW
0x140408160 FindNextFileW
0x140408168 CloseHandle
0x140408170 ReleaseSRWLockExclusive
0x140408178 AcquireSRWLockExclusive
0x140408180 GetFileType
0x140408188 PostQueuedCompletionStatus
0x140408190 SetStdHandle
0x140408198 SetEnvironmentVariableW
0x1404081a0 GetCPInfo
0x1404081a8 GetOEMCP
0x1404081b0 GetACP
0x1404081b8 IsValidCodePage
0x1404081c0 HeapAlloc
0x1404081c8 FindFirstFileExW
0x1404081d0 GetProcessHeap
0x1404081d8 HeapFree
0x1404081e0 InitializeCriticalSectionAndSpinCount
0x1404081e8 TlsAlloc
0x1404081f0 LCMapStringW
0x1404081f8 CompareStringW
0x140408200 FlsFree
0x140408208 FlsSetValue
0x140408210 SleepConditionVariableSRW
0x140408218 WakeConditionVariable
0x140408220 WakeAllConditionVariable
0x140408228 TlsGetValue
0x140408230 FormatMessageW
0x140408238 MoveFileExW
0x140408240 LockFileEx
0x140408248 UnlockFile
0x140408250 Sleep
0x140408258 FlsGetValue
0x140408260 GetModuleHandleA
0x140408268 GetProcAddress
0x140408270 GetCurrentThread
0x140408278 TryAcquireSRWLockExclusive
0x140408280 GetStdHandle
0x140408288 GetConsoleMode
0x140408290 MultiByteToWideChar
0x140408298 TlsSetValue
0x1404082a0 SetLastError
0x1404082a8 GetEnvironmentVariableW
0x1404082b0 GetTempPathW
0x1404082b8 CreateFileW
0x1404082c0 GetFileInformationByHandle
0x1404082c8 GetFileInformationByHandleEx
0x1404082d0 GetFullPathNameW
0x1404082d8 GetFinalPathNameByHandleW
0x1404082e0 SetFilePointerEx
0x1404082e8 GetModuleHandleW
0x1404082f0 CreateDirectoryW
0x1404082f8 FindFirstFileW
0x140408300 FlsAlloc
0x140408308 GetTimeZoneInformation
0x140408310 GetCommandLineW
0x140408318 GetCommandLineA
0x140408320 GetEnvironmentStringsW
0x140408328 FreeEnvironmentStringsW
0x140408330 CompareStringOrdinal
0x140408338 GetModuleFileNameW
0x140408340 GetSystemDirectoryW
0x140408348 GetWindowsDirectoryW
0x140408350 CreateProcessW
0x140408358 GetFileAttributesW
0x140408360 GetCurrentProcess
0x140408368 DuplicateHandle
0x140408370 GetCurrentProcessId
0x140408378 CreateThread
0x140408380 SleepEx
0x140408388 WriteFileEx
0x140408390 ReadFileEx
0x140408398 CancelIo
0x1404083a0 ReadFile
0x1404083a8 GetSystemTimeAsFileTime
0x1404083b0 SetFileInformationByHandle
0x1404083b8 CopyFileExW
0x1404083c0 SetHandleInformation
0x1404083c8 ExitProcess
0x1404083d0 GetModuleHandleExW
0x1404083d8 FreeLibraryAndExitThread
0x1404083e0 TlsFree
0x1404083e8 LoadLibraryExW
0x1404083f0 FreeLibrary
0x1404083f8 GetNativeSystemInfo
0x140408400 FlushFileBuffers
0x140408408 GetTickCount
0x140408410 MapViewOfFile
0x140408418 CreateFileMappingW
0x140408420 FormatMessageA
0x140408428 GetSystemTime
0x140408430 WideCharToMultiByte
0x140408438 SystemTimeToFileTime
0x140408440 GetFileSize
0x140408448 LocalFree
0x140408450 HeapDestroy
0x140408458 HeapCompact
0x140408460 LoadLibraryW
0x140408468 DeleteFileA
0x140408470 WaitForSingleObjectEx
0x140408478 LoadLibraryA
0x140408480 CreateFileA
0x140408488 FlushViewOfFile
0x140408490 OutputDebugStringW
0x140408498 GetFileAttributesExW
0x1404084a0 GetFileAttributesA
0x1404084a8 GetDiskFreeSpaceA
0x1404084b0 GetTempPathA
0x1404084b8 HeapSize
0x1404084c0 HeapValidate
0x1404084c8 UnmapViewOfFile
0x1404084d0 CreateMutexW
0x1404084d8 UnlockFileEx
0x1404084e0 SetEndOfFile
0x1404084e8 GetFullPathNameA
0x1404084f0 SetFilePointer
0x1404084f8 LockFile
0x140408500 OutputDebugStringA
0x140408508 GetDiskFreeSpaceW
0x140408510 WriteFile
0x140408518 HeapCreate
0x140408520 AreFileApisANSI
0x140408528 InitializeCriticalSection
0x140408530 EnterCriticalSection
0x140408538 LeaveCriticalSection
0x140408540 TryEnterCriticalSection
0x140408548 DeleteCriticalSection
0x140408550 GetCurrentThreadId
0x140408558 EncodePointer
0x140408560 WriteConsoleW
0x140408568 CreateNamedPipeW
0x140408570 ExitThread
0x140408578 GetStartupInfoW
0x140408580 IsDebuggerPresent
0x140408588 InitializeSListHead
0x140408590 IsProcessorFeaturePresent
0x140408598 UnhandledExceptionFilter
0x1404085a0 SetUnhandledExceptionFilter
0x1404085a8 TerminateProcess
0x1404085b0 RaiseException
crypt.dll
0x140408040 BCryptGenRandom
crypt32.dll
0x140408050 CertGetCertificateChain
0x140408058 CertFreeCertificateContext
0x140408060 CertDuplicateCertificateChain
0x140408068 CertEnumCertificatesInStore
0x140408070 CertDuplicateStore
0x140408078 CertDuplicateCertificateContext
0x140408080 CertFreeCertificateChain
0x140408088 CertVerifyCertificateChainPolicy
0x140408090 CertOpenStore
0x140408098 CryptUnprotectData
0x1404080a0 CertAddCertificateContextToStore
0x1404080a8 CertCloseStore
secur32.dll
0x140408620 GetUserNameExW
0x140408628 FreeContextBuffer
0x140408630 DeleteSecurityContext
0x140408638 FreeCredentialsHandle
0x140408640 EncryptMessage
0x140408648 ApplyControlToken
0x140408650 AcceptSecurityContext
0x140408658 AcquireCredentialsHandleA
0x140408660 InitializeSecurityContextW
0x140408668 QueryContextAttributesW
0x140408670 DecryptMessage
advapi32.dll
0x140408000 CredFree
0x140408008 GetUserNameW
0x140408010 SystemFunction036
0x140408018 RegOpenKeyExW
0x140408020 RegCloseKey
0x140408028 RegQueryValueExW
0x140408030 CredEnumerateA
ws2_32.dll
0x140408680 WSAIoctl
0x140408688 ioctlsocket
0x140408690 WSASocketW
0x140408698 connect
0x1404086a0 getsockopt
0x1404086a8 shutdown
0x1404086b0 getaddrinfo
0x1404086b8 freeaddrinfo
0x1404086c0 WSAStartup
0x1404086c8 setsockopt
0x1404086d0 WSACleanup
0x1404086d8 recv
0x1404086e0 closesocket
0x1404086e8 send
0x1404086f0 getsockname
0x1404086f8 WSAGetLastError
0x140408700 getpeername
0x140408708 WSASend
0x140408710 ind
EAT(Export Address Table) is none